What happened
RICK (Rick finance) is a BEP20 token on BNB Smart Chain whose verified source gives the owner unlimited minting. mint(address _to, uint256 _amount) is public onlyOwner and calls _mint, and the base contract has a second owner-only mint(uint256 amount) that mints to the caller; neither checks a maximum supply. Anyone holding ownership can therefore create new RICK at will, which dilutes existing holders and can be sold into a trading pair.
De.Fi's REKT database lists RICK as an exit scam / rug pull dated 2021-08-25 with no loss figure and links a BscScan page for address 0xb21bae7f…10b370; the code shows what the owner can do, not what the owner did.
How it happened
- The contract inherits OpenZeppelin
Ownable, so the deployer 0x58B4e606…7ec053 starts as owner and ownership can be moved withtransferOwnership(the owner read on 2026-09-30 is 0x0e0f3247…2e2836). RickToken.mintisfunction mint(address _to, uint256 _amount) public onlyOwner { _mint(_to, _amount); ... }, so the owner can create any amount of RICK for any address._mintruns only_totalSupply = _totalSupply.add(amount); _balances[account] = _balances[account].add(amount);, with no cap, timelock or supply check.BEP20.mint(uint256 amount)is alsopublic onlyOwnerand mints to_msgSender(), giving a direct route to newly created tokens._transferis the plain version (_balances[sender] = _balances[sender].sub(amount, ...)and_balances[recipient] = _balances[recipient].add(amount)), with no sell block, fee or blacklist, so the risk is dilution and sale of minted tokens rather than a blocked sell.- De.Fi lists the token as a rug pull; no transaction showing a mint or a sale was opened, so what the owner actually did is not established here.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
